diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dddc59597cb8d3eee352ee371220264c62f487fd..9083046cf549744d7a3d7a1652c1da2bda744ae0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -47,6 +47,42 @@ build:
     when: always
     expire_in: 1 week
 
+.build_app_image_base:
+  extends: .docker_image_builder_job_template
+  stage: deploy
+
+  needs:
+    - job: build
+      artifacts: true
+
+  variables:
+    GIT_SUBMODULE_STRATEGY: normal
+    GIT_DEPTH: 1
+    IMAGE_TAG: ""
+  script:
+    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" "$CI_REGISTRY" --password-stdin
+    - ./scripts/ci-helpers/build_instance.sh --push "$IMAGE_TAG" "$CI_PROJECT_DIR" "$CI_REGISTRY_IMAGE" --progress="plain"
+
+  artifacts:
+    reports:
+      dotenv: app_docker_image_name.env
+
+build_app_image:
+  extends: .build_app_image_base
+
+  variables:
+    IMAGE_TAG: "$CI_COMMIT_SHORT_SHA"
+
+push_protected_app_image:
+  extends: .build_app_image_base
+  stage: deploy
+  variables:
+    IMAGE_TAG: "$CI_COMMIT_REF_NAME"
+  rules:
+    - if: '$CI_COMMIT_REF_PROTECTED == "true"'
+      when: on_success
+    - when: never
+
 pages:
   stage: deploy
   script: